Two-minute brief
ISO 22301 requirements explained: video brief
A two-minute brief on ISO 22301: the shared clause structure and the continuity sequence in clause 8 that makes it a business continuity standard.
Key takeaways
- ISO 22301 shares clauses 4 to 10 with ISO 9001 and ISO/IEC 27001.
- Clause 8 sets the sequence: business impact analysis, risk assessment, strategies, plans, exercises.
- Leadership includes clear authority to invoke plans and commit money during a disruption.
- Exercises and their evaluation are part of the requirements, not an optional extra.
- The scope can cover a whole organisation or one part of it.
A shared structure with a continuity core
ISO 22301 follows the harmonised structure shared by the ISO management system standards, clauses 4 to 10, so it integrates with ISO 9001 or ISO/IEC 27001. What makes it a continuity standard is clause 8: after operational planning and control, the business impact analysis, the strategies, the plans, the exercises and the evaluation of all of them are required in a defined sequence. This short film walks through that sequence.
Context asks you to understand the organisation, its interested parties and their legal and regulatory requirements, and to define the scope, typically a statement naming the products, services and sites covered and a register of client, contractual and regulatory continuity obligations. Leadership means committed top management, a business continuity policy stating what the organisation will protect, a management sponsor and clear authority to invoke plans and commit money during a disruption. Planning covers risks and opportunities to the system itself and measurable continuity objectives.
From analysis to exercised plans
The business impact analysis establishes which activities matter most and how quickly they must resume; the risk assessment examines what could disrupt them. Strategies then decide how continuity will be achieved, plans set out how the response will run, and exercises test whether the plans work. The evaluation of all of this feeds back into the system. Terms such as maximum tolerable period of disruption, recovery time objective and recovery point objective come from this analysis.
Performance evaluation and improvement complete the cycle with monitoring, internal audit, management review and corrective action. The standard applies to organisations of every type and size, and to parts of an organisation such as a delivery centre or a data centre. Certification is assessed and decided by an independent, accredited certification body.
The scope of the certificate should name the products and services whose continuity you are promising and the locations that deliver them, so that clients can see exactly what the certificate covers.
ISO 22301 at a glance
- Purpose
- Business continuity: the capability to keep delivering products and services at an agreed level and within agreed time frames during a disruption, and to recover
- Relevant to
- Any organisation whose clients, regulators or survival depend on uninterrupted delivery: BPOs, financial services and their providers, technology and data centres, logistics, utilities, healthcare
- Edition
- ISO 22301:2019 with Amendment 1:2024; a revision is in preparation, with no publication date announced
- Certification
- Assessed and decided by an independent, accredited certification body
- Sterling's role
- Implementation with your team, from the BIA to the first exercise, with Effivity, training, internal audit and certification readiness, then Sustain™
- Cost and timing
- Total investment for an ISO 22301 BCMS depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 4 to 8 months
ISO 22301: questions people ask
Is ISO 22301 only for large organisations?
No. It applies to organisations of any type and size, and to parts of one. A small BPO delivering a critical process for a regulated client may need a certified capability more urgently than a large group. It should be proportionate: a short list of prioritised activities, affordable solutions and plans people can run.
What is the difference between ISO 22301 and a disaster recovery plan?
A disaster recovery plan restores IT systems. ISO 22301 requires how the organisation keeps delivering its products and services when any resource is lost: people, workplace, suppliers, information or technology. IT recovery is one of the solutions a BCMS relies on, and its recovery objectives should come from the business impact analysis, not from IT's assumptions.
Is ISO 22301 certification mandatory?
No law requires it in general. Client contracts, tenders and insurers increasingly make it a condition, and financial-sector and critical-infrastructure regulators require continuity, recovery and testing arrangements that a BCMS is built to provide. Rules such as the EU's DORA set their own requirements for ICT continuity, response, recovery and testing rather than naming an ISO certificate; a certified BCMS is a structured way to meet and evidence them, not a substitute for the rule itself.
Does Sterling issue the ISO 22301 certificate?
No. Sterling's role is consulting and hands-on support. The certification audit and the certification decision belong to an independent, accredited certification body. A provider offering both is selling paper.
Do we have to run an exercise before we can be certified?
The standard requires an exercise programme, and a certification auditor will want to see it working, not just planned. In a Sterling engagement at least one exercise is run before the Stage 2 audit, with its report and actions closed, so the plans are tested by you before an auditor or an event tests them.
Keep exploring
Related to this video
Read next
The complete guide
Everything on ISO 22301
Start with the ISO 22301 page, or go straight to the guide you need.
On the ISO 22301 page
Guides
- ISO 22301 BIA and exercise planning checklist
- ISO 22301 business impact analysis
- ISO 22301 certification process, step by step
- ISO 22301 certification cost
- ISO 22301 documentation
- Effivity ISO 22301
- ISO 22301 business continuity exercises
- ISO 22301 internal audit
- Ransomware recovery plan
- ISO 22301 requirements explained
- ISO 22301 vs ISO 27001
- ISO 22301 and ISO 27001
More videos: Governance, risk and resilience
- How to implement ISO 37001Implementation walkthrough · 3 min 14 s
- ISO 37001 requirements explainedTwo-minute brief · 2 min
- ISO 37500 guidance explainedTwo-minute brief · 2 min
- How to implement ISO 31000Implementation walkthrough · 3 min 15 s
- ISO 31000 guidelines explainedTwo-minute brief · 2 min
- How to implement ISO 37301Implementation walkthrough · 3 min 15 s
- ISO 37301 requirements explainedTwo-minute brief · 2 min
Talk to a consultant
Plan your ISO 22301 certification with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice